Linux: How to Move Flash Movies From Your Browser Cache

So you’ve just watched a movie, you like it and want a backup copy of it. You’ve looked in your browser’s cache directory and you’ve looked in your computer’s tmp directory but you just can’t find the flash file for the video; and you won’t find it because Flash deletes the file then reads and writes the deleted file using it’s file descriptor.

Whatever you do, do not close the browser tab that your video is playing in.

The following instructions apply to Linux. The example below shows how to copy a Flash (flv) file that’s been played in Google’s Chrome browser. Details for doing this with Firefox follow the Chrome example.

I will show you two different ways to do this. The first way is longer but more accurately locates the correct file.

Copy a Flash Movie From Your Browser: Method 1

Find the browser’s process ID (PID)

Copy ‘n’ paste this into a terminal:

top | grep -i chrom

The terminal will list all running processes that contain the phrase “chrom”. The “top” command lists the processes and the “grep” command scans each line returned by “top” for “chrom”. The “-i” switch makes the search case insensitive.

Top will keep listing processes until you press “Ctrl+C” to stop it running. The first column in each line shows a number. That number is the ID of the running process i.e it’s PID. When “top” begins repeating the same PIDs, press Ctrl+C to stop “top”.

An application’s process ID changes each time the application is restarted so if you were to run top, close Chrome then restart Chrome, those PIDs would change. Chrome spawns a separate process for each open tab. So this will be easier the fewer tabs you have open.

Use the PID to Locate the File Descriptor (FD)

Modify this next command to scan for file names containing “flashx” opened by each PID used by Chrome:

lsof -p [PID] | grep -i flashx

“lsof -a” lists all open files and “grep -i flashx” scans each line returned by lsof for the text “flashx”.

Using the example results shown for “top | grep -i chrom”, here is how I would use lsof:

Notice the second column lists the process ID that has opened the file “FlashXXxnqe2F”. That file is marked as deleted.

The File Descriptor (FD) is in the fourth column, just after the username. In the above example it is listed as “38u”. The letter shows whether the file is open for read access (r), write access (w) or read and write access (u). Ignore the letter.

Copy the File to Your Desktop

Because the actual file has been deleted and is only accessible through its file descriptor, it’s not possible to just copy “FlashXXxnque2F”, for example. We need to revive the file through its file descriptor. For instance, we would copy it with

cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv

Using the above example, I would copy the deleted Flash file with

cp /proc/4324/fd/38 ~/Desktop/movie.flv

I’m now able to play the file in VLC or some other suitable media player.

Applying This to Firefox

The only bit to change is the “top” command.

Where we use “top | grep -i chrom” for Chrome, for Firefox we use

top | grep -i plugin-containe

Copy a Flash Movie From Your Browser: Method 2

This method is less accurate but much quicker and requires less mental memory work but it’s not suitable when lots of different instances of Flash are being run unless you can guess the file from its size.

Instead of finding the process ID, just look for any open file that contains “flash” in it:

lsof | grep -i flash

That command may take a minute or two to run and will provide results similar to

If you use a version of grep that allows regular expressions, use this command:

lsof | grep -i -r "flash.*deleted"

Now copy it, as before, using

cp /proc/[PID]/fd/[HANDLE] ~/Desktop/movie.flv

Exceptions

Not all streamed videos use Flash, YouTube videos included. You’ll need to look in your browser cache to locate the file after it’s streamed or use a browser plugin to download the file. The method outlined above is specific to copying Flash streams after you’ve watched them and decided you would like a copy for later viewing.